DragonFlyBSD Kernel Audit
DF-0950 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/vm/vm_mmap.c b/sys/vm/vm_mmap.c
--- a/sys/vm/vm_mmap.c
+++ b/sys/vm/vm_mmap.c
@@ -1086,15 +1086,23 @@
 		}
 		if (how & MCL_FUTURE)
 			map->flags |= MAP_WIREFUTURE;
+		if (rc == 0)
+			goto out;
 	} while(0);
 
 done:
+	/*
+	 * DF-0950: only reached on failure (rc != 0); unwind the entries we
+	 * marked MAP_ENTRY_USER_WIRED in this call.  A successful MCL_CURRENT
+	 * must keep its pages wired.
+	 */
 	RB_FOREACH(entry, vm_map_rb_tree, &map->rb_root) {
 		if (entry->eflags & MAP_ENTRY_USER_WIRED) {
 			entry->eflags &= ~MAP_ENTRY_USER_WIRED;
 			vm_fault_unwire(map, entry);
 		}
 	}
+out:
 
 	vm_map_unlock(map);